Skip to content
FibonacciRequest a demo

Legal protection · 05

Patients' photographs.

The photo in the record serves the treatment. Publishing it is something else, and requires explicit and specific consent. The Garante has fined doctors and aesthetic clinics for "before and after" posts on social media.

Information, not legal advice. Read on 12 October 2026.

Photographs and data

The rule

1 of 4

Regulation (EU) 2016/679, article 9

"The processing of" "data concerning health" "shall be prohibited". The prohibition is lifted, among other cases, where "the data subject has given explicit consent to the processing of those personal data for one or more specified purposes".

Read the textEUR-Lex

Photographs and data

The precedents

Web document 10095836

Garante privacy, decision of 12 December 2024

The facts
A surgeon posts before-and-after photos of a patient who had facial surgery on Instagram. The signed consent forms did not cover publication, and the photos had been taken for internal use.
What was decided
Fine of 20,000 euros. The processing took place «outside the purposes of care». The photos had already been removed.
Read the textGarante per la protezione dei dati personali

Photographs and data

What protects the physician

  • Consent to publication separate from consent to processing: explicit, for that channel, revocable.
  • Knowing, photo by photo, which consent you have, before publishing it.
  • Photos dated and linked to the treatment, so you can answer in time those who ask for their own.
  • A log of who opens the record, and a procedure for breaches.
  • A privacy notice that states how long the data is kept.

In Fibonacci

  • Every photograph is encrypted before it leaves the browser, with its own key.
  • The metadata of the shot, including location, is removed before saving.
  • Every time a photo is opened it stays in the access log.
  • Fibonacci publishes nothing: photos leave only when you decide.

Photographs and data

What these sources do not say

In the decisions reviewed, the Garante recalls that the healthcare professional «no longer has to ask the patient for consent for the processing necessary for the requested healthcare service». Consent is needed for what is not care, such as publication. On improper access to records, the decisions reviewed concern hospitals and nursing homes, not aesthetic medicine practices.

Documentation must be done while you work, not when the lawyer's letter arrives.

In half an hour we show you how Fibonacci records consents, sessions, batches, and photos during the visit.

Request a demoContinue: Healthcare advertising →All the risks